Privacy Policy

1. Data We Collect

We collect information you provide directly: name, email address, company name, billing information, and API credentials when you register or use our services.

We also collect technical data automatically: IP addresses, browser type, device identifiers, usage logs, and API request metadata to operate and improve the platform.

2. How We Use Your Data

Your data is used to provision and maintain your API access, process payments, issue invoices, and provide technical support.

We may use aggregated, anonymized usage data for product analytics, fraud detection, and service improvements. We do not sell your personal data.

3. Cookies & Tracking

We use strictly necessary cookies to authenticate sessions and maintain security. With your consent, we use analytics cookies (e.g., Google Analytics) to understand platform usage.

You may manage or withdraw cookie consent at any time via our Cookie Preferences panel or browser settings. Disabling non-essential cookies will not affect core functionality.

4. Third-Party Sharing

We share data only with trusted sub-processors (payment processors, cloud infrastructure, fraud prevention providers) under data processing agreements that meet GDPR standards.

We will disclose data to law enforcement or regulatory authorities only when legally required. We do not share data with advertisers.

5. Your Rights (GDPR / CCPA)

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data where no legal obligation requires retention.
• Portability: receive your data in a structured, machine-readable format.
• Opt-Out (CCPA): California residents may opt out of any sale of personal information — we do not sell data.
• Withdraw Consent: withdraw consent for marketing or non-essential cookies at any time.

6. Data Retention

We retain account and transaction data for up to 7 years to comply with financial regulations and tax obligations.

API log data is retained for 12 months. You may request earlier deletion of non-regulated personal data by contacting us.

7. Security

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access to production systems is restricted to authorized personnel under least-privilege controls.

We conduct regular vulnerability assessments and maintain an incident response plan. In the event of a breach affecting your data, we will notify you within 72 hours as required by GDPR.

8. Children's Privacy

Our services are intended for business users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we discover such data has been collected, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy to reflect changes in law or our practices. We will notify registered users via email at least 14 days before material changes take effect.

Continued use of our services after the effective date constitutes acceptance of the revised policy.

10. Contact & Data Controller

blackhawnketwork acts as the data controller for personal data processed through this platform.

For privacy inquiries, data subject requests, or to reach our Data Protection Officer, contact us at [email protected] or write to: blackhawnketwork, 200 West Street, New York, NY 10282, United States.